CVE-2025-52204 – Reflected XSS / HTML Injection in Znuny customer.pl endpoint

Summary

A Reflected Cross-Site Scripting (XSS) and HTML Injection vulnerability exists in Znuny, allowing attackers to inject arbitrary JavaScript or HTML via the parameter defined by the system configuration CustomerPanelSessionName in the customer.pl endpoint.

Classification

• CVE: CVE-2025-52204
• CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CVSS v3.1 (researcher assessment): 6.1 Medium
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Public CVE record: CVE-2025-52204

Impact

Successful exploitation may allow an unauthenticated remote attacker to:

• inject arbitrary HTML or JavaScript into the response
• manipulate the customer-facing login interface
• display deceptive or phishing-style content
• redirect users to attacker-controlled resources
• execute script in the victim's browser within the context of the affected application

Attack Requirements

• No authentication required
• Remote exploitation via crafted GET request
• Access to the public customer-facing interface

Affected / Observed Versions

Confirmed in controlled testing

• Znuny LTS: 6.5.10
• Znuny: 7.1.3

Observed during real-world research

The issue was also observed during research on publicly exposed real-world instances running:

• Znuny LTS : 6.5.9 - 6.5.18
• Znuny 7.0.11 - 7.2.3

To avoid unnecessarily exposing third-party systems, specific targets, URLs, and validation screenshots from those instances are intentionally omitted from this public repository.

Observed Affected Paths

During testing and research, the following request patterns were observed:

• 6.5.9 - 6.5.18: /otrs/customer.pl?OTRSCustomerInterface=$PAYLOAD
• 7.0.11 - 7.2.3: /znuny/customer.pl?OTRSCustomerInterface=$PAYLOAD

These are observed request patterns and may vary depending on product branch and installation layout.

The affected input is the one defined by the CustomerPanelSessionName system configuration. In observed deployments, this may appear as OTRSCustomerInterface, depending on the system configuration.

Fixed Versions

The vendor addressed this issue in:

• Znuny LTS 6.5.19
• Znuny 7.3.1

Proof Of Concept

Reflected payload in controlled testing

Znuny LTS 6.5.10

Znuny 7.1.3

Mitigation / Workarounds

Administrators should upgrade to the vendor-fixed versions:

• Znuny LTS 6.5.19
• Znuny 7.3.1

Additional good practices include:

• reviewing public exposure of the customer-facing interface
• restricting unnecessary public access where operationally possible
• monitoring requests targeting customer.pl
• reviewing whether local configuration hardening reduces exposure, understanding that configuration changes alone may not constitute a full product fix

References

• CVE-2025-52204 Record
• Znuny 7.3.1 Release Notes
• Znuny LTS 6.5.19 Release Notes

Disclosure Note

This repository documents a coordinated vulnerability disclosure process.
It intentionally does not include:

• a live public target list
• mass-scanning data
• a weaponized payload set
• active exploitation guidance

The goal is to preserve technical accuracy while minimizing unnecessary risk to third parties.